Input validation error in cURL - CVE-2016-8625
Published: August 1, 2018 / Updated: August 3, 2020
Vulnerability identifier: #VU33014
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-8625
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to manipulate data.
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.
Affected software
cURL
Arch Linux
Slackware Linux
curl (Alpine package)
Arch Linux
Slackware Linux
curl (Alpine package)
How to mitigate CVE-2016-8625
Install update from vendor's website.
cURL - update to 7.51.0
curl (Alpine package) - update to 7.51.0-r0
curl (Alpine package) - update to 7.51.0-r0
External References
- http://www.securityfocus.com/bid/94107
- http://www.securitytracker.com/id/1037192
- https://access.redhat.com/errata/RHSA-2018:2486
- https://access.redhat.com/errata/RHSA-2018:3558
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8625
- https://curl.haxx.se/CVE-2016-8625.patch
- https://curl.haxx.se/docs/adv_20161102K.html
- https://security.gentoo.org/glsa/201701-47
- https://www.tenable.com/security/tns-2016-21
Related Security Bulletins
- Input validation error in curl.haxx.se cURL
- Input validation error in curl (Alpine package)
- Arch Linux update for lib32-libcurl-gnutls
- Arch Linux update for libcurl-gnutls
- Arch Linux update for libcurl-compat
- Arch Linux update for curl
- Arch Linux update for lib32-libcurl-compat
- Arch Linux update for lib32-curl
- Slackware Linux update for curl